New malware-infected site found every five seconds

Experts warn of 'dramatic rise' in web-based threats

Robert Jaques, vnunet.com 22 Apr 2008

The first quarter of 2008 has been marked by a "dramatic increase" in web-based threats, with a new infected webpage being discovered every five seconds, security experts warn.

Sophos identified an average of more than 15,000 newly infected web pages each day from 1 January to 31 March 2008.

The security firm warned that 79 per cent of these malware-hosting sites are found on legitimate websites that have been hacked.

February saw the website of UK broadcaster ITV fall victim to a poisoned web advert campaign which targeted Windows and Mac users.

In March a Euro 2008 football ticket website was hacked by cyber-criminals in an attempt to infect unwary fans.

In contrast, just one in every 2,500 emails is now infected, compared to one in every 909 in 2007.

The top two web threats, Mal/Iframe and Mal/ObfJS, which are together responsible for more than half of all online malware found by SophosLabs, are programmed to infect websites by taking advantage of vulnerabilities.

"About one per cent of web requests now deliver an infected page, most of which are legitimate websites belonging to people just trying to earn a living, " said Carole Theriault, senior security consultant at Sophos.

"Already in 2008 we have been reminded that it is not just the small, independent sites that are being hacked.

"With compromised websites of household names now serving up malware, it is more important than ever for users to ensure that they use a fully protected machine, and for businesses to protect their web servers from attack."

Sophos reported that the list of countries hosting the most infected web pages shows some "interesting changes" since 2007.

The US, in particular, has experienced unprecedented growth, from hosting less than 25 per cent of all infected pages overall in 2007, to almost half in the first three months of 2008.

China has demonstrated the biggest drop, from hosting more than half of all infected pages seen by Sophos in 2007, to just under a third in the first quarter of 2008.

Elsewhere in the chart, newcomer Thailand was responsible for hosting one per cent of all malware infected pages, while the UK hosted 1.1 per cent, down from three per cent in the same period last year.

"The US and China are no strangers to this chart, and have long held the top two spots in this hall of shame," said Theriault.

"However, the bottom half of the chart remains fluid, indicating that users need to remain vigilant.

"Those hosting websites need to ensure that they have patched against vulnerabilities that might be lurking on their site to avoid becoming part of the problem."

See also: